Follow Slashdot stories on Twitter

 


Forgot your password?
Close
typodupeerror
×
Security

Convincing Management of Network Security Issues? 62

Posted by Cliff from the and-getting-the-problem-solved dept.
An Anonymous Coward asks: "Here at work for internet connectivity, we share a Cisco 2600 router with the administrative folks in the other half of the building. Our development network is isolated from theirs, safely behind a Debain firewall--we just show up as one IP with _very_ few ports open. The Cisco connects directly into a Linksys DSL router, which is *supposed* to be providing NAT for both of our networks. Instead, it's acting needlessly as an extra hub, with the incoming feed plugged into its port 2 and the outgoing feed in port 3. The feed from port 3 plugs into a 24-port hub, which connects all of the admin workstations and our Debian box. Each workstation, in turn, has a static IP (we have one too). This is due to a variety of reasons--so we've been told--but what it boils down to is the incompetence of the 'Microsoft Certified (w/Internet) Network Engineer,' who's responsible for the routers, the administrative network, and their Windows 2000 corporate webserver." Now, the workplace is left with no firewall and a Network Engineer that is downplaying the problem to the higher-ups. What would be the best way to communicate that there really is a problem?

"I went up the chain and explained the problem to my boss. He was horrified. He took it to his boss (who also happens to be in charge of said Network Engineer). The result was less-than spectacular. My boss' boss came out, with The Engineer in tow, who after fiddling with things for a while, proclaimed everything to be 'locked down,' and then they left. What we later discovered was that she'd only closed down a few of the webserver's non-essential ports and had done nothing about the Linksys firewall situation. But in the process, she'd managed to convince our collective higher-ups that the problem wasn't as big as we (read: the lowly, know-nothing, software developers) had made it all out to be and now nobody wants to hear a word about it. In other words, they have NO firewall at all, and we've been unable to convince them that this is a Bad Thing(tm).

Since The Engineer and her boss have always tended to be reactive, rather than proactive, I logged onto Steve Gibson's Leak Test from an admin workstation and showed them the results. Unfortunately, this 'parlor trick' failed to generate much in the way of enthusiasm. So what I'm looking for are (mostly) non-destructive suggestions to alert them to the dangers of their network configuration. Short of posting their IP's in a #skript_kiddie_channel and daring them to trash everything, how should I bring it to their attention in a, shall we say, meaningful way?"
This discussion has been archived. No new comments can be posted.

Convincing Management of Network Security Issues? More

Convincing Management of Network Security Issues?

Comments Filter:

  • Tough position. (Score:5, Insightful)

    by gaudior ( 113467 ) <{marktjohns} {at} {gmail.com}> on Wednesday May 22, 2002 @06:44AM (#3564454) Homepage
    I suggest you get everything in writing. Document the snot out of the system, paying particular attention to the obvious points of failure.

    Get as many of your peers to agree that there is a problem, and then sign a letter to the top boss, outlining the whole situation. Make it an open letter, if you must. It's clear there is gross incompetence going on, and if you care about the organization, you need to get this thing resolved.

    If a large number of you break the chain of command, and do it loudly, you might succeed.

    • Re:Tough position. (Score:3, Insightful)

      by Thing 1 ( 178996 )
      If a large number of you break the chain of command, and do it loudly, you might succeed.

      Or you'll all become the next round of layoffs. Tread carefully; it's a buyer's job market.

    • Re:Tough position. (Score:3, Insightful)

      by Jon Peterson ( 1443 )
      I suggest you get out more.

      You are a developer. You are not responsible for Network Security. It's not your job. How would you like it if this MCSE person can emailed your boss saying she was concerned about the unmaintainability of your code?

      By the sound of your own report, you've not even discussed this (or tried to discuss this) with the Network Admin woman, and instead have gone straight to your boss. That, I'm afraid, is both foolish and rude. No two ways about it.

      I've no idea if there even is a problem here. To be honest, it sounds like there's a developer who reckons they are the mutts nuts and is pissed off about this MCSE girl because she's got more root passwords than he does, even though he is the l33t unix haxxor and she is some lam3a55 windoze type. If you see what I mean.

      So, basically, I'd just forget about it, because your position in this argument is already fatally damaged by not having deigned to talk to the network admin.

      But, let's assume that there is a reall security problem here, and that this MCSE person really is not doing their job properly. Well, yes, you have a responsibility to make sure your concerns are known. In fact, it should be your job to make sure your concerns are known. AND THAT'S IT. IT IS NOT YOUR JOB TO FIX THEM.

      Go and talk to your boss. Give your boss a calm, reasonable assessment of the situation. Explain in simple but thorough terms what you think the issues are. Suggest some ways you think they could be addressed. Say how you'd be happy to help the network team fix the problems.

      And then leave it. It is your boss's responsibility to take the issue further if they see fit.

      • Re:Tough position. (Score:3, Insightful)

        by billn ( 5184 )
        "By the sound of your own report, you've not even discussed this (or tried to discuss this) with the Network Admin woman, and instead have gone straight to your boss. That, I'm afraid, is both foolish and rude. No two ways about it."

        Slow down there, Mr. Manners. He did exactly what was right, from his position as a developer. He informed to the next level of HIS chain of command. That's exactly right for someone in his position. It would have actually been worse if he'd crossed the lines and went straight to Engineering. She'd have much more cause for complaint, then.

        The problem lies in that the person in charge of 'network' engineering is a certified 'systems' engineer. I think it's safe to say that Microsoft doesn't place enough emphasis on network fundamentals when it comes to issuing MCSE certificates. Even exposing the network layers via the MS platform generally requires you to shell out some bucks for tools to do it.
        • If you (re)read the original article, the person 'responsible' for (not)maintining the network is identified an MCNE. The grandparent post is where the mis-identification as an MCSE occurred.

          That having been said, the problem may still lie in her training as an MCNE. A friend of mine who did the A+ certification said that much of it is about how to calm down users when things blow up. It seems to me that she learned that part of her training pretty well.
          :-(

        • I agree with this position - business etiquette says go up the chain of command to get a message to someone in another department. Having said that, it can be useful to approach someone directly on an informal basis, assuming they are approachable.

          In a breif and uncharacteristic defense of MCSEs (or MCNE), one entire non-elective module (out of 6 for an MCSE) is devoted to TCP/IP networking, from the ground up. The go over the OSI model extensively, and all of the TCP/IP theory. But they don't cover routing protocols (BGP, RIP, etc) in great detail, and they don't cover network security as a separate issue (i.e. you are trained to maintain and diagnose a network, and told to get an expert to deal with firewalls).

    • Absolutely, I would nmap the whole subnet and put the results into a document too. Then point out that if the Administrator didn't know that you'd just scanned the whole network she's not paying any attention to the security of that net.

      I would definitely put a firewall between your dev network and the router, then run Snort on the Debian box and firewall each workstation as well. (paranoid - me? - yes)

      At the end of the day if something happens to your development work because of someone else's lack of knowledge or caring about security issues, it's your stuff that will suffer.
    • Nod. As somebody who's been in this situation, I'll tell you that in the face of such resistance, all you can do is have proof that you brought it up, wait for the horses to run away, then put in some overtime closing and locking the door after the fact.

  • #script_kiddie_channel could break your legs (Score:5, Insightful)

    by DieNadel ( 550271 ) on Wednesday May 22, 2002 @06:47AM (#3564458)
    I'd say that since you now has "a point to prove", the first thing you should do is pray for your network NOT to be cracked into. If this comes to happen, some very suspicious eyes would fall on you.
    Why don't you suggest a limited pen-test, documenting very well how you could get in, what damages you could inflict and, most important, how should it all be fixed (but don't, at any point, be picky with The Engineer, or else this all could be seemed as an ego war.)

  • The 'other' people (Score:2, Interesting)

    by mnmn ( 145599 )
    Do these others using the network belong to the company? They sound like they can be trusted. Have you tried talking to the MCSE guy himself? It might be easier to convince him than the higher ups. As long as the system is working fine I dont think the higher-ups would be worried, so going after the admin guy is the bet. I'm an admin and Ive taken advice from other workers at more than one occasion.
    • It was quite obvious that the MCSE guy didn't understand the implication of exposing those workstations out to the Internet. In my limited experience, these types normally do a brain shutdown if they come across something they don't understand. Talking to this MCSE person in this case is likely to be fruitless.

  • Do nothing. (Score:2, Interesting)

    by Anonymous Coward
    You've told them about what you think is a problem, they think otherwise, they are responsible -> Don't do anything. Stepping on their toes will get you in trouble, plus there isn't anything legal you could do to provide further proof that there is a problem anyway. You would have to be in a position where you could avoid working "below" the folks, who you are going to make look bad, in the future, either by moving up the ladder, getting them fired or by leaving the company. If you are not in that position: It's not your job to secure the network - don't do it.

  • Easy (Score:2, Funny)

    by MullerMn ( 526350 )
    What would be the best way to communicate that there really is a problem?

    1) Post that IP address here
    2) ..
    3) Vulnerability demonstrated

    --
    Andy

    • Re:Easy (Score:1, Funny)

      by Anonymous Coward
      1) Post that IP address here
      2) Vulnerability demonstrated
      3)
      4) Profit
  • Ready yourself with useful examples of the many difference exploits and the insecurities. And keep nagging high ups doomsday scenarios and how it will cost the highest figure possible if the system were to ever be compromised.

  • Why to document (Score:2, Insightful)

    by samjam ( 256347 )
    Try to get written acknowledgement of your report; merely "to cover yourself".

    The bosses bosses may not be keen to give this and wonder why you are so insistent on covering yourself.

    They may then take another look for fear that they end up uncovered when the dirt starts to fly.

    Sam
  • All else failing, go to the linky, move the fscking cable to the right port, and leave...

  • Ask for a third party security audit (Score:4, Insightful)

    by Diamon ( 13013 ) on Wednesday May 22, 2002 @08:12AM (#3564571)
    Have your boss try to talk their boos into a security audit by a third party. Try and convince them that an independant third party should be able to satisfy your concerns, and is much cheaper thank recovering from script kiddies. This also keeps your butt out of the frying pan it could be in if you go looking for holes and get accused of cracking.

    • Re:Ask for a third party security audit (Score:1, Insightful)

      by Anonymous Coward
      HAHAHAHAHAHA

      A company that is using a Linksys DSL router, and CHAINED HUBS...

      ...that sound like a company that can afford a security audit?

  • Document and move on to something else (Score:4, Insightful)

    by Bravo_Two_Zero ( 516479 ) on Wednesday May 22, 2002 @08:13AM (#3564576)
    I'd agree with the first post. Document your objections and the exploits. Give it to your boss. If he wants to CC everybody, that's his business.

    It sounds like a political issue (know-nothings vs. know-it-alls ... thank goodness I always consider myself a know-nothing... keeps an open mind). But, even a political issue does have a cost/benefits analysis. If you can put a price on fixing the issue (time, people, money), you make an even stronger case.

    Also, if you do get nailed, you can point to the cost/benefits analysis to say "see, $5,000 then would have saved $25,000 in damages". On the other hand, in some cases, you'll end up on the other side of that equasion. If the cost to fix outweighs the potential damage, you put it to unbiased numbers.

    You won't be seen as "chicken little" crying about the falling sky; you'll be a professional who bases the comments on a fiscal analysis of the risk. If your professional guess is unsupported by the findings, that's ok (and, let's be honest, you're almost certainly on the right side of the equasion here).

    But, pointing to technical weaknesses won't help your case. It will make you a pain in the side of all parties concerned. They will cut off their heads to spite you (and, may already have done so, according to your details). Put it to dollars, document it and go to your next challenge.

  • dangerous quandry... (Score:3, Insightful)

    by digitalmuse ( 147154 ) on Wednesday May 22, 2002 @08:28AM (#3564624)
    here's something to swing by your boss, see if he has got someone else in management who's willing to hold onto a copy of your analysis in a CYA capacity for archival purposes. Explain that it was brought up before and was not seen as 'vital', but you would like to provide some basic CYA for your group.
    Handle it as a purely CYA exercise, and downplay the doom & gloom angle.
    Have your boss E-mail your politely worded analysis to the MCSiE goober, Goober's boss, and your boss's buddy. Make sure you thank him afterwords. Goober knows that you've put your analysis into the corporate meme-sphere, and Corner Office dude is likely to be impressed by your forward thinking and tact.
    In the best case, Goober gets the hint and lashes together at least a basic firewall. (and if it gets 0wn3d later, he's still going to have some serious shoveling to do if it doesn't address the bullet-points in your CYA of Networking Doom)
    Worst Case, the general network becomes kiddie-pr0n central, everyone who owns stock gets heated, and you have a documented paper-trail that keeps you out of harms way.
    Since you've already brought up the subject with the Goober's Boss and gotten a less than stellar reaction, further pursuit along that avenue may be interpreted as a petchulant code-geek on a witch-hunt. But maybe showing people that it worries you enough to handle it in a CYA manner will engender a self-preservation interest in folks.
    However, if your boss doesn't want to push this one, DO NOT pursue it on your own. That kind of thing is often construed as the work of someone who doesn't know when to hear the word 'NO' and is liable to get you branded as a troublemaker.
    Good luck.

    • CYA (Score:1)

      by shippo ( 166521 )
      Please don't use acronyms like CYA (Cover Your Ass for those, like me, who had to look it up) without explaining them. Slashdot is a global comunity and there will be a good number of people who have no idea what it means.

      • Re:CYA (Score:2, Funny)

        by Mawbid ( 3993 )
        LOL, we're supposed to explain every TLA for those too lazy to STFW or look it up on ESR's JF?

        Or maybe IHBT, IHL, IWHAND?

  • You left a lot out. (Score:3, Insightful)

    by Neck_of_the_Woods ( 305788 ) on Wednesday May 22, 2002 @08:35AM (#3564654) Journal
    Do you know if she is putting up filters on the firewall? Do you know if you she is NATing? Looking at the information in the artical all you know is that you have internet connectivity and you don't like that way that it is being handled. Seeing how you already took the time to tell her boss and not direct it at her, you have gone on the offense, you are now threat to her. Now she is going to prove you wrong and shut you down. Which it seems she has. Next time think about how you would feel if someone went to there boss, without talking to you and being a MCSE of all things, and said your code sucked. Not knowing an whole hell of a lot in your eyes about code or your job. Then took his boss to you boss and slamed you about your code. What would you do. I know it is hard to see it this way, but your put her in a bad spot right or wrong you went about it the wrong way.

    Make a friend not an enemy, and next time just ask for help and ask them to explain it to you so you can learn. Ask the right questions to point them where you want them to look. Believe me they want to cover there ass just like you would, and will fix the problem if they don't have to loose face. Let them think they came up with the idea to change it, or could it be that you are gunning for her job and your pay at "I know more than you" backfired a bit? Anyway, learn the politics they are going to be everywhere.

    • From my view, this programmer knows more than this mere mortal girl. Just because she has a MCSE degree doesn't mean she's competent in her job.
      • From my view, this programmer knows more than this mere mortal girl. Just because she has a MCSE degree doesn't mean she's competent in her job.

        nor does programing on a linux machine and spouting out some jargon that sounds correct. You have one side of the story, and filtered at that. Agreed that he sounds like he has a pretty good handle on it, but he just went about it a little bit the wrong way. From that perspective it looked hostle.

        People just don't warm up to the guy that says "YOU SUCK!, and your not doing you job to the boss." Trust me that chick will be gunning for him now.

    • Re:You left a lot out. (Score:3, Informative)

      by Thing 1 ( 178996 )
      Anyway, learn the politics they are going to be everywhere.

      This is so true. I know several people who lost their jobs due to politics. Stupid fucking internal fighting showing that the company has lost its competitive stance and is now "competing" with itself.

      Beware of politics. Not everyone who treats you nice is your friend, nor has your best interests in mind. I'm shaking a little right now, because I'm so pissed at these events I couldn't stop. No lack of skills on their part, or enthusiasm, track record, etc. -- they just butted heads with a 600-lb gorilla who likes to fire people to show who's the boss.

      Make sure you don't get caught in the cross-fire -- threatening someone's job (which you (the submitter )did to the lady MCSE, whether he understands it or not) isn't the best way to keep your head down.

  • Info Security Survey (Score:4, Informative)

    by rakerman ( 409507 ) on Wednesday May 22, 2002 @09:14AM (#3564804) Homepage Journal
    Survey says: The best way to convince management of the need for security is "Conduct vulnerability assessments or penetration tests to demonstrate need for security" (Figure 9, page 4)

    2001 IT Security Survey [infosecuritymag.com] (PDF)

    It's not easy, but the best you can do is document the vulnerabilities, present your case, and KEEP presenting it. See if there are any corporate policies or legal requirements that support your position.

  • How to prove your point. (Score:4, Informative)

    by bob_jordan ( 39836 ) on Wednesday May 22, 2002 @09:34AM (#3564904)
    A better way might have been to have a chat with the MCSE and ask them how things are set up. Take an interest in security saying you are looking for ways to make your home network secure and want to know how it is done at work. Treat someone as an expert in their field and (even if they are not) they will take it as a compliment. Treat them as an idiot and they will take offence. You don't mention if the Cisco has been set up with any access control lists. Is that how she is locking down the network? Now the MCSE is going to be on the defensive since you went to her bosses boss.

    If you still feel the need to prove a point then take it as read that this is how the company wants the system to work and make imaginative use of it. Ask the admin staff to leave a printer turned on over the weekend because you want to do some work from home and may need to print some stuff out. Plug a box in after your debian firewall to do file serving and ask your boss that, since you have access to files on this machine from home, would he mind you working from home one morning while you wait for a plumber.

    Most of all be subtle. The shotgun approach obviously didn't work.

    Bob.

  • Classic Dev/Admin problem (Score:4, Informative)

    by j-turkey ( 187775 ) on Wednesday May 22, 2002 @11:17AM (#3565542) Homepage
    This is indicitave of a classic problem between Devs and Sys Admins -- SysAdmins thinking that they know something that the Devs don't, (all the while owning responsibility for the systems in question) and the Devs, who think that they don't necessarily need an overpaid SysAdmin to do fulltime stuff that they can do in a heartbeat (and maintain rights to their development and production systems and networks).

    (Disclaimer: I do not necessarily believe either of the two above statements, it is just a simplfication of my understanding of this canonical problem)

    I think that the first thing that you should do is to make nice with your admin. I know that you might not like her, and its clear that you see her as a know-nothing Microsoft Certified with no real-world expertise...and this may be the case. But its important that you put these feelings aside and first try a little harder to work with her on this.

    Its also important to take a CYA approach and document everything that you suggest to her...especially the stuff that she is not receptive to. This is much easier to do in a mid to larger sized company than a really small one (really small
    Show where the vulnerabilities are in writing, using well-known and respected tools and methodologies. Recommend a course of action (again, in writing). You can keep this informal be doing the "in-writing" stuff over email -- this way its not overtly official, but you have a paper-trail just the same. Also, ask your SA to document her changes.

    Now if she is not receptive to your suggestions, then it will be time to report this stuff to higher-ups. Be careful about trying too hard to point this stuff out, because you'll start looking like you're spending too much time doing someone else's job.

    After all this is said and done, and your butt is covered. The last thing that I'd suggest you do is to recommend an external security audit. If you are being discredited due to your recommendations, you should have a third party come in and do a full write-up on your network's security. This is something that every manager will see, and if the auditors are from the right place, your MCSE will be hard-pressed to discredit them -- and will be forced to make the changes.

    Hope this helps.


    -Turkey

  • Talk to her, and protect your subnet (Score:4, Informative)

    by Chacham ( 981 ) on Wednesday May 22, 2002 @12:14PM (#3565993) Homepage Journal
    First, talk to the lady. She may very well feel threatened by you. That may sound rediculous, but it can easily be true. Once that happens, defense mechanisms go up, and regardless of how correct you are, she'll fight.

    You may want to talk to her. Lose your pride, and ask her if she is willing to set aside an hour, with the next week, to discuss your concerns. With that flexibility she'll probably accept the offer and set aside an hour after work, or the next day. She may be tense, because she may think this is merely a ploy of yours to "one-up" her. So, during the meeting, you must be very carefull to let her know that she makes the decisions, and that you are only offering information and concerns for her evaluation. Be apologetic, this gives her an easy way out of your erstwhile confrontation.

    Finally, should all else fail, ask your boss to allow the developers to have their own subnet. Then, simply, put up a firewall for your subnet. This way, you'll be safe, and (if you don't shove it in their face) the rest of the company may want to be as "safe" as you.

  • Cover your butt, then drop it (Score:3, Insightful)

    by Some Wanker ( 398209 ) on Wednesday May 22, 2002 @12:42PM (#3566171)
    You are at risk of hurting your career if you push this too hard if there is no audience. If the top management does not want to hear they have a problem, then they will not, and they will get mad at you for pushing it. Send out a butt-covering memo. (Another post covered that well.) and then make sure all of your stuff and your teams stuff is backed up and protected as well as possible, and then drop it.

    The only thing worse than seeing it coming and having it happen, is seeing it coming, having it happen, and then people being mad at you for it. People tend to vent on people in a position to say "I told you so".

  • She?! (Score:2, Funny)

    by qurob ( 543434 )
    What we later discovered was that she'd only closed down a few of the webserver's non-essential ports and had done nothing about the Linksys firewall situation

    She? You have a whole different problem. You should be nailing this grrl geek!
  • You can't change anything. You're not her boss, you're not her boss's boss, and you can't do a thing to change the root cause.

    It's probably worse - you're now a troublemaker. Everything you do to correct the situation will be tainted.

    Document evrything - hardcopy, not email. All conversations, all meetings, the tripwire demo, write it up, date/time stamp it and print it. Make two copies, seal them and write the date/time across the seal. If (when) it all boomarangs back to you, you'll get to spend a fun day in the head guy's office, with your boss, and your paper trail.

    Make sure YOUR stuff is backed up, of course.

  • I'm in a similar situation currently, although I've come to realize that going to the higher-ups isn't the way to go. They don't give a sh*t about technical details; as long as we haven't had any problems _yet_ they won't be interested in my suggestions. My plan is just to wait until something bad happens (and it will, as it will with your mental-midget MCSE.) You have control of your department's firewall, so when Bad Things do happen you won't be affected.
  • Here's a convincing argument: If you don't close it, you might very well get sued when some 1337 h4xx0r kiddie uses your network as a jumpoff point.

    I should know - this happened to my site literally an hour ago, the database got quite comprehensively trashed. Your domain name wouldn't happen to end in infogroup.com by any chance, would it? ;)

    It's your duty to the internet community to fix this and fast.
  • You tried to convince them. They were retards. Any more, and you risk negative side effects from the management ("Look! He's a troublemaker, he probably hacks into it himself!"). Make sure yourr own workstations are secure (they seem to be reasonably so), and just laugh if anything happens to the administrative boxen. Really, it's not your problem *or* fault.

    Does make me sad that another bootcamp MCSE is filling a job that I could do more comptently. It sucks being unemployed. Oh well, my life will get back on track when millions of these managers realize that millions of these bootcamp MCSE's are worthless, and I get a million job offers. Haha.
    • Oh well, my life will get back on track when millions of these managers realize that millions of these bootcamp MCSE's are worthless, and I get a million job offers.

      That won't happen though. What will happen is those MCSEs will get larger budgets to buy more firewalls, software with pretty interfaces and other 'necessities' to prevent h4>0r5 like j00 from getting in. It's all in the attitude, really, and I don't think too many MCSEs will lose their jobs even if their networks get compromised. "Hey, these hackers are *tough*! They beat all our best trained people. Better spend more money on hardware and training!". That's what'll happen. Obviously not all MCSEs are horrible, but there are too many people with certifications from MS which shouldn't really have them (really, too many people with certifications period who shouldn't have them) but as long as certification is an industry, the certifications themselves will carry less meaning than they otherwise should.
      • Please, I know you're right, but you're also depressing me even more than I am.

        Currently, I'm sitting here at work, with nothing to do (helpdesk on a holiday, very few workers in the plants) and this is my absolute last night. I'm in the unemployment line (again) tomorrow morning. And I sure as hell don't have the $1000+ it would cost me to become an MCSE. Besides, I believe the lobotomy is still mandatory.

        Also, please don't call me a h4x0r or even a hacker. At one time, in another decade that word might have described me, but it no longer does so. Even now, I'm fiddling with a schematic for a PCI card I'm going to build. PLX9052 pci chipset ($17) a serial eeprom, zilog z8530($2) and some glue. Finally ditching the old server at home, and lack of ISA slots isn't going to stop me from having a localtalk nic. May even work on an econet interface, if I ever have spending money again.
  • The problem with leaktest is that it shows possible problems.. not real ones.

    If you really want to pursue this, try using ethereal and watch the net... a thirty-60 second snip will probably give a nice slice of viral life (if there is any).

    Look for things like:

    • Port 1443 scans (the recent MS worm),
    • lot's of Nimda-type HTTP requests ( GET /scripts , GET /c/winnt, get /_mem_bin )
    • other wierd activity
    Check at a couple of odd times (especially late at night, early morning).

    If this MCNE is as bad as your story makes her out to be, chances are that you've been trojaned up the butt. Doing the Cover Your Ass dance sounds like a good idea too, since that one would be seen as doing your job -- as opposed to the MCNE's job.

    Just for the fun of it, see if you can mount the unprotectes work file systems from home. Your ISP may have blocked that port at their boundary -- but who knows.
    ______________

    The best approach (if you can pull it off, having already gone over her head), might be to go quietly offer to help the MCNA. If you can make her receptive to some support, she may be willing to work on problems that she probably doesn't have the solutions to at the moment. I doubt that she's negligent... More likely, the MCNA doesn't actually teach you how to secure networks in a real environment .. :-{

  • A while ago I read an interesting 'business guide book' for westerners going to Japan, covering lunch and meeting etiquette etc.
    The book couldn't stress enough about never making your client say 'No, I'm wrong' etc. Even though it may give you a few moments of pleasure watching the MCSE squirm in embrassment, and ignorance, it will be MUCH better if you can both come out winning.
    Maybe you could suggest an alternative option, that would be good for her. That way neither of you have to admit to being wrong, and you both come out looking positive, helpful and co-operative, which will impress your bosses too.
  • I'll be the first to admit that I'm not a network security expert, but I gave LeakTest a go, and as far as I can tell, all it does is make an outbound connection to grc.com on port 80. What exactly would that prove?

    Hmm, maybe it uses SOAP... ;)
  • At this point its too late. They have already flagged you as a troublemaker. All you can do now is to get it in writing that there may be a problem..

    The issue is that since it is not in your job description to be looking at this, in the best case situation you may have already put yourself on a "short list"... If ANYTHING goes wrong, you are going to be the first person they suspect; and the MCSE may even try to use you as the scapegoat... "we didnt have any problems till he mentioned them"....

    [I know of at least one sitiation where a person informed an ISP of a security issue on thier network that they failed to fix. When it was exploited, to cover their asses, they blamed the person that told them of the issue by saying that it could only have been exploited by someone with "specific" knowledge]
  • First, make sure you are squeaky clean. Double check your ACLs on the Debian box. At least your part of the LAN is safe then.

    Secondly, document everything you can see wrong with the current infrastructure. Go into as much detail as you can - lack of ingress/egress, vulnerability of Win2K server, etc, etc. Compile a meaty report, and put your name on it.

    Then, send a copy to everyone in the company remotely involved. If anyone at all listens, perhaps something will happen about it, if not, you get the last laugh when something bad does befall your company, especially as you will be straight in line for a security-related promotion.

    Remember that its harder for someone to ignore something in writing than it is if you start a conversation in passing on the way to the coffee machine.

    If you can gain written authority, consider running your own penetration test from an external location, or hire an inexpensive company to give you a quick once-over.

Slashdot Top Deals

Say "twenty-three-skiddoo" to logout.

Close